Nozomi Networks

The Nozomi Networks platform, available as a hardware, virtual appliance, or via the Vantage Cloud product, provides comprehensive monitoring for OT, IoT, and IT networks. It combines asset discovery, network visualization, vulnerability assessment, risk monitoring, and advanced threat detection in a unified solution. The integration is designed to gather alerts and asset information from Nozomi, whether deployed on-premises or in the cloud via Vantage, ensuring seamless visibility and security across environments.

Network Security · Nozomi Networks

Details

IDNozomi Networks
ProviderMitsubishi Electric
CategoryNetwork Security
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

The Nozomi Networks integration enables the collection of alert and asset information from Nozomi’s suite of products, including Guardian, CMC, and the cloud-based Vantage platform. These solutions provide comprehensive OT/IoT/IT network monitoring through asset discovery, network visualization, vulnerability assessment, risk monitoring, and threat detection — all within a unified platform.

This integration is used to gather alert and asset information from Nozomi.

Configure Nozomi Networks in Cortex

Parameter Description Required
endpoint Endpoint url True
username Username True
password Password True
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
isFetch Fetch incidents False
fetchTime Get incidents from last False
riskFrom Get incidents from risk level False
fecthAlsoIncidents Fetch also nozomi incidents False
incidentPerRun Specifies the maximum number of incidents to retrieve False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

nozomi-find-assets

This command permits you to get some assets from Nozomi, you can use the query filter to to refine your search. With the limits you can decide the max number of assets you can retrieve from Nozomi, the limit can’t be bigger than 1000.

Base Command

nozomi-find-assets

Input

Argument Name Description Required
filter You can add a filter to get exactly the assets you want. For example ‘where ip match 10.0.1.10’, ‘where vendor == Selta Telematica S.p.a’ Optional
limit Maximun number of assets get from Nozomi, can’t be bigger than 1000 Optional

Context Output

Path Type Description
Nozomi.Asset.id String uniq id of an asset
Nozomi.Asset.level Number network layer
Nozomi.Asset.capture_device String source from which the asset was captured
Nozomi.Asset.ip Unknown array of asset ip
Nozomi.Asset.mac_address Unknown array of asset mac address
Nozomi.asset.mac_vendor Unknown array of mac vendor
os String operating system
vendor String asset vendor
Nozomi.Asset.firmware_version String firmaware version
serial_number String serial number
product_name String product name
type String asset type as ‘OT_device’
protocols Unknown array of asset protocols

Command Example

!nozomi-find-assets limit=3 filter="| where level == 4"

Context Example

{
    "Nozomi": {
        "Asset": [
            {
                "name": "10.197.23.146",
                "level": "1",
                "id": "a3707ec4-7c85-437e-9d46-dbabd39b4dc2",
                "appliance_hosts": [
                    "nozomi-dev"
                ],
                "capture_device": "/vagrant/ids-testapi/fixtures/iec104_mestre_mini.pcap",
                "ip": [
                    "10.197.23.146"
                ],
                "mac_address": [
                    "00:02:3e:99:fe:1b"
                ],
                "mac_address_level": {
                    "00:02:3e:99:fe:1b": "unconfirmed"
                },
                "vlan_id": [],
                "mac_vendor": [
                    "Selta Telematica S.p.a"
                ],
                "os": "",
                "roles": [
                    "slave"
                ],
                "vendor": "",
                "_asset_kb_id": "",
                "vendor:info": {
                    "source": "passive"
                },
                "firmware_version": "",
                "firmware_version:info": {
                    "source": "passive"
                },
                "os_or_firmware": "",
                "serial_number": "",
                "serial_number:info": {
                    "source": "passive"
                },
                "product_name": "",
                "product_name:info": {
                    "source": "passive"
                },
                "type": "OT_device",
                "type:info": {
                    "source": "passive"
                },
                "protocols": [
                    "iec104"
                ],
                "nodes": [
                    "10.197.23.146"
                ],
                "zones": [
                    "RemoteRTU"
                ],
                "custom_fields": {}
            }
        ]
    }
}

Human Readable Output

Nozomi Networks - No assets found

nozomi-close-incidents-as-security

Close incidents as security

Base Command

nozomi-close-incidents-as-security

Input

Argument Name Description Required
ids List of IDs to close as security Optional

Context Output

Path Type Description
Nozomi.CloseStatus String Status of the request
Ids Unknown Ids closed
CloseAction String As the incidents are closed

Command Example

!nozomi-close-incidents-as-security ids=['fa441619-39d4-46c1-a2fb-fc3b285c0b64']

Context Example

{
    "Nozomi": {
        "CloseAction": "closed_as_security",
        "CloseStatus": "SUCCESS",
        "Ids": [
            "fa441619-39d4-46c1-a2fb-fc3b285c0b64"
        ]
    }
}

Human Readable Output

Command changes the status of alerts passed as “closed_as_security” in Nozomi Networks platform.

nozomi-close-incidents-as-change

Close incidents as change

Base Command

nozomi-close-incidents-as-change

Input

Argument Name Description Required
ids List of IDs to close as change. Optional

Context Output

Path Type Description
Nozomi.CloseStatus String Status of the request
Ids Unknown Ids closed
CloseAction String As the incidents are closed

Command Example

!nozomi-close-incidents-as-change ids=['fa441619-39d4-46c1-a2fb-fc3b285c0b64']

Context Example

{
    "Nozomi": {
        "CloseAction": "closed_as_change",
        "CloseStatus": "SUCCESS",
        "Ids": [
            "fa441619-39d4-46c1-a2fb-fc3b285c0b64"
        ]
    }
}

Human Readable Output

Command changes the status of alerts passed as “closed_as_change” in Nozomi Networks platform.

nozomi-query

Can execute a nozomi query to get all the information you want.
A query can be something like that: “alerts | select id name status ack | where status == open”
Take a look to n2os manual to know how to do a query.

Base Command

nozomi-query

Input

Argument Name Description Required
query A valid query Required

Context Output

Path Type Description
Nozomi.Query.Result Unknown An array of items
Nozomi.Error String In case the query is not correct the errors shows you the reason.

Command Example

!nozomi-query query="links | where from match 192.168.10.2 | where protocol match ssh"

Context Example

{
    "Nozomi": {
        "Result": []
    }
}

Human Readable Output

Nozomi Networks - Results for Query

No entries.

nozomi-find-ip-by-mac

Find a node ip from a mac address

Base Command

nozomi-find-ip-by-mac

Input

Argument Name Description Required
mac a mac address Required
only_nodes_confirmed This argument permit you to return only the nodes IPs from a mac address of nodes having the status to ‘confirmed’. Default value is True. Optional

Context Output

Path Type Description
Nozomi.IpByMac.ips Unknown Array of ips found for the mac address passed, empty if not found.
Nozomi.Error String Usually an ip not found error

Command Example

!nozomi-find-ip-by-mac mac='00:0c:29:22:50:26' only_nodes_confirmed='True'

Context Example

{
    "Nozomi": {
        "Error": "Ip not found"
    }
}

Human Readable Output

Nozomi Networks - No IP results were found for mac address: ‘00:0c:29:22:50:26’

Configuration parameters

  • endpoint — Endpoint url (required)
  • credentials — Username (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • fetchTime — Get incidents from last
  • riskFrom — Get incidents from risk level
  • fecthAlsoIncidents — Fetch also Nozomi incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentPerRun — Incidents per run

Commands (5)

  • nozomi-close-incidents-as-change

    Close incidents as change.

  • nozomi-close-incidents-as-security

    Close incidents as security.

  • nozomi-find-assets

    This command permits you to get some assets from Nozomi, you can use the query filter to to refine your search. With the limits you can decide the max number of assets you can retrieve from Nozomi, the limit can't be bigger than 100.

  • nozomi-find-ip-by-mac

    Find a node ip from a mac address.

  • nozomi-query

    Can execute a nozomi query to get all the information you want. A query can be something like that: "alerts | select id name status ack | where status == open" Take a look to n2os manual to know how to do a query.

Source

NozomiNetworks.py NozomiNetworks_test.py NozomiNetworks.yml NozomiNetworks_description.md command_examples.txt
Download History Raw 
commonfields:
  id: Nozomi Networks
  version: -1
name: Nozomi Networks
display: Nozomi Networks
category: Network Security
provider: Mitsubishi Electric
fromversion: 5.0.0
tests:
- No tests
description: "The Nozomi Networks platform, available as a hardware, virtual appliance, or via the Vantage Cloud product, provides comprehensive monitoring for OT, IoT, and IT networks. It combines asset discovery, network visualization, vulnerability assessment, risk monitoring, and advanced threat detection in a unified solution. The integration is designed to gather alerts and asset information from Nozomi, whether deployed on-premises or in the cloud via Vantage, ensuring seamless visibility and security across environments."
sectionorder:
- Connect
- Collect
configuration:
- display: Endpoint url
  name: endpoint
  defaultvalue: https://nozomi_instance.com
  type: 0
  section: Connect
  required: true
  additionalinfo: Your Nozomi Networks appliance endpoint URL appliance
- display: Username
  name: credentials
  type: 9
  section: Connect
  required: true
  additionalinfo: A user having APIs access privileges credentials.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Get incidents from last
  name: fetchTime
  defaultvalue: 7 days
  type: 0
  section: Collect
  required: false
  additionalinfo: 'Set the time frame to get incidents by. Default is 7 days. Other examples: 30 seconds, 1 minute, 4 hours, 2 days...'
- display: Get incidents from risk level
  name: riskFrom
  defaultvalue: '1'
  type: 15
  section: Collect
  required: false
  options:
  - '1'
  - '2'
  - '3'
  - '4'
  - '5'
  - '6'
  - '7'
  - '8'
  - '9'
  - '10'
  additionalinfo: Will only fetch incident with a risk higher or equal to the selected value.
- display: Fetch also Nozomi incidents
  name: fecthAlsoIncidents
  type: 8
  section: Collect
  required: false
  additionalinfo: In the Nozomi platform, alerts are single events and incidents are an aggregation of alerts. By default only alerts will be fetched by CORTEX XSOAR, however, if selected, incidents will also be fetched.
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  type: 19
  section: Collect
  required: false
- display: Incidents per run
  name: incidentPerRun
  defaultvalue: '100'
  type: 0
  section: Collect
  required: false
  additionalinfo: Specifies the maximum number of incidents to retrieve during each fetch operation. This value determines the size of the result set fetched from the source system. Default is 100.
script:
  script: ''
  type: python
  commands:
  - name: nozomi-find-assets
    arguments:
    - name: filter
      description: You can add a filter to get exactly the assets you want, to know how to filter assets using the Nozomi query language take a look at the n2os user documentation. For example 'where ip match 10.0.1.10', 'where vendor ==  Selta Telematica S.p.a'.
    - name: limit
      description: Maximun number of assets get from Nozomi, can't be bigger than 100.
      defaultValue: '50'
    outputs:
    - contextPath: Nozomi.Asset.id
      description: uniq id of an asset.
      type: String
    - contextPath: Nozomi.Asset.level
      description: network layer.
      type: Number
    - contextPath: Nozomi.Asset.capture_device
      description: source from which the asset was captured.
      type: String
    - contextPath: Nozomi.Asset.ip
      description: array of asset ip.
      type: Unknown
    - contextPath: Nozomi.Asset.mac_address
      description: array of asset mac address.
      type: Unknown
    - contextPath: Nozomi.asset.mac_vendor
      description: array of mac vendor.
      type: Unknown
    - contextPath: os
      description: operating system.
      type: String
    - contextPath: vendor
      description: asset vendor.
      type: String
    - contextPath: Nozomi.Asset.firmware_version
      description: firmaware version.
      type: String
    - contextPath: serial_number
      description: serial number.
      type: String
    - contextPath: product_name
      description: product name.
      type: String
    - contextPath: type
      description: asset type as 'OT_device'.
      type: String
    - contextPath: protocols
      description: array of asset protocols.
      type: Unknown
    description: This command permits you to get some assets from Nozomi, you can use the query filter to to refine your search. With the limits you can decide the max number of assets you can retrieve from Nozomi, the limit can't be bigger than 100.
  - name: nozomi-close-incidents-as-security
    arguments:
    - name: ids
      description: List of IDs to close as security.
      isArray: true
    description: Close incidents as security.
  - name: nozomi-close-incidents-as-change
    arguments:
    - name: ids
      description: List of IDs to close as change.
      isArray: true
    description: Close incidents as change.
  - name: nozomi-query
    arguments:
    - name: query
      required: true
      description: A valid query, to learn how to create a Nozomi query you can take a look into the Nozomi Networks user documentation.
      defaultValue: alerts | count
    outputs:
    - contextPath: Nozomi.Query.Result
      description: An array of items.
      type: Unknown
    description: "Can execute a nozomi query to get all the information you want.\nA query can be something like that: \"alerts | select id name status ack | where status == open\"\nTake a look to n2os manual to know how to do a query."
  - name: nozomi-find-ip-by-mac
    arguments:
    - name: mac
      required: true
      description: a mac address.
      defaultValue: "''"
    - name: only_nodes_confirmed
      required: true
      default: true
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: This argument permit you to return only the nodes IPs from a mac address of nodes having the status to "confirmed". Default value is True.
      defaultValue: 'True'
    outputs:
    - contextPath: Nozomi.IpByMac.ips
      description: Array of ips found for the mac address passed, empty if not found.
      type: Unknown
    - contextPath: Nozomi.IpByMac.mac
      description: Mac found the ips.
      type: String
    description: Find a node ip from a mac address.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  subtype: python3